Securitylab Security Research
Source-scoped identity with 5 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 5 PoCs on this page
ExploitDBPHP168 6.0 - Command Execution
ExploitDB exploitPublished 2009-10-28Not analyzedUnlinked1 file
ExploitDBphpCMS 2008 - File Disclosure
ExploitDB exploitPublished 2009-10-19Not analyzedUnlinked1 file
ExploitDBDeDeCMS 5.1 - SQL Injection
ExploitDB exploitPublished 2009-10-14Not analyzedCVE-2009-38061 file
ExploitDBEmpire CMS 47 - SQL Injection
ExploitDB exploitPublished 2009-10-05ExploitCVE-2009-22691 file
Analysis
Technical assessment
PHP script that sends a crafted HTTP POST request to Empire CMS 47 to exploit a SQL injection vulnerability in the CLIENT-IP header, extracting admin credentials (username, password, rnd) from the phome_enewsuser table.
Backdoor review
No backdoor observed in reviewed code
The supplied PHP script is a straightforward proof-of-concept for CVE-2009-2269. It constructs a single HTTP POST request to exploit a SQL injection vulnerability in Empire CMS 5.1 by injecting a crafted SQL payload into the CLIENT-IP header. The script prints informational banners, sends the request, and outputs the server response. No backdoor, secondary payload, persistence mechanism, or deceptive behavior was observed.
Classification basis and observed behavior
Classification basis
The script actively sends a malicious HTTP request containing a crafted SQL injection payload to extract sensitive data from the target database, which constitutes exploitation rather than mere detection or scanning.
exploits/php/webapps/10069.php:27-28exploits/php/webapps/10069.php:41-48Requirements
- Target must be running Empire CMS 47 with the vulnerable e/tool/gbook/ component accessible.
exploits/php/webapps/10069.php:5 - PHP >= 5 and MySQL >= 4.1 required on the target server for the SQL injection payload to work.
exploits/php/webapps/10069.php:9
Observed behavior
- Script constructs a SQL injection payload that extracts the admin username, password, and rnd value from the phome_enewsuser table via a subquery in the CLIENT-IP header.
exploits/php/webapps/10069.php:27-28 - Script opens a socket to the target host on port 80 and sends a crafted HTTP POST request to /e/enews/index.php with the SQL injection payload in the CLIENT-IP header.
exploits/php/webapps/10069.php:29-48 - Script instructs the user to visit the guestbook page (e/tool/gbook/?bid=1) to view the extracted admin hash.
exploits/php/webapps/10069.php:54
Behaviors behind the backdoor verdict
Observables
- Sql Injection Payload
- Payload withheldThe script injects this SQL payload into the CLIENT-IP header to extract admin credentials from the phome_enewsuser table. This is the documented exploit behavior for CVE-2009-2269.
exploits/php/webapps/10069.php:27-28 - Network Connection
- Payload withheldThe script opens a TCP connection to the target host on port 80 to deliver the exploit payload. This is the expected behavior for a web application exploit.
exploits/php/webapps/10069.php:41 - Output Instruction
- Payload withheldThe script instructs the operator to manually visit a URL to view the extracted password hash, which is a common post-exploitation step in SQL injection PoCs.
exploits/php/webapps/10069.php:54
What the analysis did not establish
- Evidence is limited to the single PHP script; no external libraries, tools, or referenced resources are included.
- The script's actual execution, reliability, or safety is not verified; only the source code is analyzed.
- Only the single PHP file (exploitdb/exploits/php/webapps/10069.php) was reviewed. No external resources, libraries, or network content fetched by the script were inspected.
- The script's output instruction (line 54) directs the operator to manually visit a URL, which could potentially expose the operator to client-side attacks if the target server is compromised, but this is not a behavior of the script itself.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.